Researchers recently identified changes in DarkCloud Stealer’s distribution and obfuscation techniques, first observed in April 2025. These methods include a new infection chain with ConfuserEx obfuscation and a final payload written in Visual Basic 6 (VB6). Previous attacks linked to DarkCloud Stealer also used AutoIt for evasion, detailed in our earlier report....